Waves 1.7.1 build 19

Waves 1.7.1 build 19 is a maintenance release. Download Waves.dmg, verify it against Waves.dmg.sha256, and drag Waves to Applications. Existing installs receive this build through Sparkle once the appcast is updated.

Waves 1.7.1 build 19 is a maintenance release: security repairs from the
September 5 source scan, Wave Link bridge hardening, Sparkle 2.9.6, and
release-tooling fixes. The release owner deferred exhaustive performance
benchmarks and the physical Elgato hardware pass for this release; the
Wave Link control path remains fail-closed and covered by loopback tests.

Changed

• Updated Sparkle to 2.9.6, which contains upstream security fixes. Testing did
  not reproduce exploitability in Waves.
• Added privacy-safe launch milestones and a repeatable comparison harness for
  measuring startup. No startup improvement is claimed before the measurements
  are complete.
• Bound the release evidence, signed tag, external Elgato receipt, and published
  files more tightly to their source revision and release authority.

Fixed

• Preserve URL automation route provenance and reject changes that Wave Link
  owns instead of reporting them as Waves changes.
• Refuse control authority when different runtime identities claim the same
  logical app, and keep the incumbent route's controller and settings instead
  of letting a spoofed bundle identifier displace them.
• Keep automation authority on URL volume, mute and unmute commands so they
  cannot relocate channels that Wave Link owns.
• Bound Wave Link metadata reads and JSON-RPC responses: regular files up to
  64 KiB only, one deadline per request, 64 messages and 4 MiB per response,
  and socket closure on timeout or cancellation.
• Coalesce Core Audio device-change notifications into a bounded mailbox so a
  burst cannot queue unbounded tasks or UI refreshes.
• Record the confirmation event when a first control request finds the route
  already in the requested state.
• Strip terminal control characters and escape sequences from app-supplied
  text before wavesctl prints it.
• Release tooling: disable Git replacement objects in the release launcher, and
  make the phase runner finish TERM-resistant descendants and report cleanup it
  cannot confirm instead of claiming success.
• Bound the local control listener's self-check and backlog handling so a stalled
  or saturated check cannot hold shutdown work indefinitely.
• Stage DMG and publication work in private directories, retain failed DMG
  workspaces when detach fails, and publish completed files transactionally.

Release evidence

The attached release-evidence.candidate.json and release-evidence.publication.json are the sealed manifests embedded in the signed v1.7.1 tag. security-scan-receipt.json records the security review and finding dispositions; remote-elgato-approval.json records that the release owner deferred the physical Wave Link and Stream Deck pass for this release. notary-log.json is Apple's notarization log for the attached DMG and release-source-identity.json binds the build to its exact source revision.